Last updated: October 14, 2026
This policy explains how we handle your personal data when you use Syncro, in line with GDPR (EU 2016/679), Spanish LOPDGDD and LSSI-CE.
Syncro is operated from Spain (registered address pending incorporation; will be updated upon formation). Controller: Syncro team. Contact for GDPR rights and inquiries: hello.syncroapp@gmail.com. If a Data Protection Officer is appointed, details will be shown here.
Account (name, email, avatar), credentials (bcrypt-hashed password, Google and GitHub OAuth tokens), platform usage (projects, boards, tasks, comments, assignments and images you attach to tasks, stored in an object storage service), voluntary feedback (bug/suggestion type, 1–5 rating, free-text up to 2000 chars, the page URL where it is sent and, optionally, an image; do not include third-party or sensitive data), the public contact form (name, email, subject and message so we can reply; we do not store your IP address), the connection credentials for AI agents (OAuth or personal access tokens stored only as a hash, with their scope) and the audit log of those agents' calls and, only with consent, aggregated analytics.
Contract (create and run your account/projects, invitations, authentication), legitimate interest (security, fraud/abuse prevention and improvement, including feedback to fix bugs) and consent (Google Analytics 4 and submitting the contact form so we can respond). Nothing is sent to Google without consent. No marketing emails: only transactional emails (invite, verification, password reset) on a contractual basis.
We keep your data while your account is active. After deletion, account and content, including images attached to your tasks, are erased or anonymized promptly, subject to statutory blocks of up to 6 years (commercial/tax law). Feedback: 12 months after closure (including its image) or until you request erasure. Contact form inquiries: 12 months after resolution. Unfinished image uploads (staging): 24 hours. GA4: 14 months. Cookie consent (syncro_consent): 12 months. AI agent audit log: up to 12 months. Technical security logs: up to 30 days.
Processors: Neon (PostgreSQL and S3 object storage, EU, eu-central-1), Vercel (hosting, EU), Resend (transactional email, possible processing outside EU under Standard Contractual Clauses) and, only with consent, Google LLC (Analytics, possible US transfer under EU-US Data Privacy Framework, see policies.google.com). If you connect a third-party AI agent, it accesses your data under your authorization (OAuth); its processing is governed by the privacy policy of the provider you choose and is outside Syncro's control. We do not sell or transfer your data. No marketing transfers.
Request access, rectification, erasure, objection, restriction and portability at hello.syncroapp@gmail.com with subject “GDPR – rights request” and identify your account, or from your Profile → Export data / Delete account. We reply within 1 month (extendable by 2 months for complexity). You may also complain to the Spanish AEPD (aepd.es). Withdrawing analytics consent does not affect prior lawful processing.
We apply technical and organisational measures to protect your data (TLS in transit, password hashing, agent tokens stored only as a hash, role-based access control, audit logging of agent calls and rate limiting).
You must be at least 14 years old to use Syncro from Spain. If you are younger, you need guardian consent.
We will update this policy when needed and notify you by reasonable means. Questions: hello.syncroapp@gmail.com.